On October 27, 2021, CREAM Finance was exploited for $130 million via flashloan-enabled oracle manipulation. Attacker used flashloans from MakerDAO and Aave to manipulate yUSD price, then minted unbacked yUSD and crYUSD by exploiting vault accounting and composability across Curve and Aave.